Differential Review

What it does

This skill reviews the security implications of a change in context. It looks beyond modified lines to relevant history, caller relationships and uncovered behavior, then asks for findings tied to observable evidence. That makes it useful for a small-looking change whose consequences extend into authentication, external calls or other sensitive boundaries.

Best for

A pull request, commit or regression fix that needs a focused security review. Provide the comparison base, relevant tests and the intended behavior so the reviewer can distinguish a deliberate policy change from a defect.

Tradeoffs and requirements

A diff review is limited by the available context and cannot establish the absence of vulnerabilities. An agent can still misunderstand an access model or produce an unproven attack scenario. The skill declares broad repository and shell tools; those permissions should be bounded to the review environment.

Unknown; inspect source requirements and supporting scripts.

Install from the source

Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.

npx skills add https://github.com/trailofbits/skills/tree/2be6433b39e009cd2b6fd3be1895f6b1faa5af9a/plugins/differential-review/skills/differential-review --skill differential-review

Review pinned skill folder ↗ · CLI documentation ↗

After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.

Safety & review signals

Static review only. This is not a security audit or a guarantee of safety.

SKILL.md text only; scripts, dependencies and runtime behavior not audited.

No configured text patterns matched. Unmatched or concealed behavior can still exist.

Allowed tools declaration: Read Write Grep Glob Bash. Runtime permissions and network behavior: Unknown.

AI Craft Pad Skill Score

86/100 · Metadata coverage 100% · Model 1.0

Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.

Documentation

100/100

100

Maintenance

100/100

100

License Clarity

100/100

100

Repository Health

100/100

100

Compatibility Evidence

80/100

80

Popularity

70/100

70

Originality

80/100

80

Static Safety

60/100

60

Suggested workflow

Establish the baseline, inspect the changed trust boundary and affected callers, then check the evidence for each suspected regression. Pair with property-based-testing when an invariant can express the behavior at risk.

How to judge the result

Require a concrete trigger, affected location and consequence for each finding. State coverage limits and separate demonstrated defects from hypotheses that still need a reproducible case.